The vulnerability arises from the download_and_copy() function in hopper/setup.py, which uses tarfile.extractall() to extract NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre‑plant a symlink in the predictable cache directory that is used during the build. When the extraction runs, the symlink causes a binary to be written to an attacker‑chosen location, giving the attacker arbitrary file write with the same process. This flaw could allow tampering with installed components or altering the runtime environment of the tool.

FlashAttention from Dao‑AILab, versions up to and including 2.8.3.post1. The flaw affects the build process that downloads and copies NVIDIA toolchain archives and is relevant to any environment where the affected code is executed locally during a build or install.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of < 1% and the vulnerability is not listed in the CISA KEV catalog. Attack requires local file‑system access to the build sandbox and the ability to modify the cache directory. An attacker who can execute code in that directory can create a symlink to an arbitrary path and force the tarfile extraction to write files, resulting in arbitrary file write with the privilege level of the build process. The risk is confined to trusted users or compromised build machines.